CVE Vulnerability Catalog

Versions of Dsniff 2.3, fragroute 1.2, and fragrouter 1.6 downloaded from monkey.org on May 17, 2002, have been modified to include a backdoor, allowing remote attackers to access the system.

The phrafx and phgrafx-startup programs in QNX RTOS 4.25 and 6.1.0 do not properly drop privileges before executing the system command, allowing local users to execute arbitrary commands by modifying the PATH environment variable to reference a malicious crttrap program.

TeeKai Tracking Online 1.0 uses weak encryption of web usage statistics in data/userlog/log.txt, allowing remote attackers to identify IPs visiting the site by dividing each octet by the MD5 hash of '20'.

The isadmin.php file in PhpWebGallery 1.0 allows remote attackers to gain administrative access by setting the photo_login cookie to pseudo.

East-Tec Eraser 2002 does not clear Windows alternate data streams on NTFS file systems, allowing attackers to recover sensitive information that was supposed to be deleted.

Eraser 5.3 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted.

SQL injection vulnerability in Mailidx before version 20020105 allows remote attackers to execute arbitrary SQL commands via the search web page.

Heap-based buffer overflow in Floositek FTGate Pro 1.05 and FTGate Office 1.05 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long POP3 APOP USER command.

The MOSIX Project clump/os 5.4 creates a default VNC account without a password, allowing remote attackers to gain root access.

CVE-2002-2091 describes a format string vulnerability in Deception Finger Daemon (decfingerd) version 0.7 that may allow remote attackers to execute arbitrary code via the username in a finger request.

Microsoft Outlook 2002 allows remote attackers to execute arbitrary JavaScript code, even when scripting is disabled, via an 'about:' or 'javascript:' URI in the href attribute of an 'a' tag.

search.cgi in AGH HTMLsearch 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the template parameter.

Artekopia Netjuke before 1.0 b7 allows remote attackers to execute arbitrary code on the web server, possibly via the section parameter, which is passed to an eval call.

Gallery version 1.3.2 contains a remote file inclusion vulnerability in publish_xp_docs.php, allowing remote attackers to inject arbitrary PHP code by specifying a URL to an init.php file in the GALLERY_BASEDIR parameter.

The publish_xp_docs.php file in Gallery version 1.3.2 allows remote attackers to execute arbitrary PHP code by modifying the GALLERY_BASEDIR parameter to point to a URL on a remote web server that contains the code.

The Telindus 1100 ASDL router running firmware 6.0.x uses weak encryption for UDP session traffic, allowing remote attackers to gain unauthorized access by sniffing and decrypting the administrative password.

An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1, does not prepend a '/' character in certain URL patterns, which prevents the proper enforcement of role mappings and policies in applications that use the extension.

The admin.html file in MySimple News 1.0 stores its administrative password in plaintext, allowing remote attackers to gain unauthorized access to the web server by viewing the source of admin.html.

IPFilter versions 3.1.1 through 3.4.28 allow remote attackers to bypass firewall rules by sending a PASV command string as the argument of another command to an FTP server.

Buffer overflow in Alsaplayer 0.99.71, when installed setuid root, allows local users to execute arbitrary code via a long command line argument (-f or -o).